Venue networks fail. A ticketing platform that stops working when the Wi-Fi does is not really a ticketing platform.
A signed manifest, not a guess
Approved devices download a cryptographically-signed manifest scoped to the device. The device holds no signing secret — it validates scans against the manifest.
The server always wins
Scans queue durably and reconcile when you reconnect. A rejected scan can never become an admission, and duplicates resolve to a single accepted entry.